What this control covers
Establish and maintain a security awareness program. The purpose of a security awareness program is to educate the enterprise's workforce on how to interact with enterprise assets and data in a secure manner. Conduct training at hire and, at a minimum, annually. Review and update content annually, or when significant enterprise changes occur that could impact this Safeguard.
Why it matters
Most successful attacks involve a human; training closes the gap technical controls cannot.
How to implement
AWS
Manage all changes in Terraform/CloudFormation; enforce SCPs that deny console writes for prod. Use AWS Config rules + conformance packs (CIS, HIPAA, PCI) to detect drift.
Azure
Azure Policy + Blueprints baseline landing zones; Bicep/Terraform as IaC and Policy Insights for drift.
GCP
Org Policy Service for guardrails and Config Validator in CI to pre-check Terraform plans against policy as code (Rego).
On-premises
Roll out role-based security awareness annually + phishing simulations quarterly. Track completion in your LMS and tie to performance review for repeat-fails.
Evidence to collect
infra_scan— See the iCompaas Evidence library for the canonical source for this evidence type.
Infrastructure posture tooling (AWS Config, Azure Policy, Nessus) verifies platform hardening. Focus: Establish and Maintain a Security Awareness Program.
Quick checklist
- Establish And Maintain — Network / Data
- Protect — Network / Data
- Conduct — Network / Data
Related articles on this site
- Microsoft Cloud Security Posture Management (CSPM)
- NIST 800-171 3.2.3 Provide security awareness training on recognizing and reporting potential indicators of insider threat.
- NIST 800-171 3.4.2 Establish and enforce security configuration settings for information technology products employed in organizational systems.
- CMMC 2.0 AT.3.058 Provide security awareness training on recognizing and reporting potential indicators of insider threat.